Keycloak's missing timestamp validation allows attackers to extend SAML response validity periods

A flaw was found in Keycloak's SAML brokering functionality. When Keycloak is configured as a client in a Security Assertion Markup Language SAML setup, it fails to validate the NotOnOrAfter timestamp within the SubjectConfirmationData. This allows an attacker to delay the expiration of SAML...

org.keycloak:keycloak-dependencies-server-min (4.0.0.beta1), org.keycloak:keycloak-model-jpa (4.0.0.beta1) +2 more potentially affected by CVE-2026-1190 via org.keycloak:keycloak-services (4.0.0.beta1)

org.keycloak:keycloak-services MAVEN version 4.0.0.beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-dependencies-server-min 4.0.0.beta1 - org.keycloak:keycloak-model-jpa...

com.github.vzakharchenko:chillispot-radius-plugin (1.4.6), com.github.vzakharchenko:cisco-radius-plugin (1.4.6) +31 more potentially affected by CVE-2026-1190 via org.keycloak:keycloak-services (18.0.2)

org.keycloak:keycloak-services MAVEN version 18.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin 1.4.6 -...

org.keycloak:keycloak-account-freemarker (1.3.0.final), org.keycloak:keycloak-broker-oidc (1.3.0.final) +10 more potentially affected by CVE-2026-1190 via org.keycloak:keycloak-services (1.3.0.final)

org.keycloak:keycloak-services MAVEN version 1.3.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.3.0.final - org.keycloak:keycloak-broker-oidc...

ch.nerdin.keycloak.extensions:avatar-extension (0.0.1), com.caputchin:caputchin-keycloak (0.2.0) +107 more potentially affected by CVE-2026-1190 via org.keycloak:keycloak-services (>=26.0.0, <=26.5.2)

org.keycloak:keycloak-services MAVEN version =26.0.0, =1.2.0, =1.1.0, =1.0.1, =1.1.0, =1.0.0, =4.1.0-26.0, =4.1.0-26.0, =2.0.0-26.0, =1.1.1-26.0, =2.1.2 and more Source cves: CVE-2026-1190 Source advisory: GHSA-63V5-26VQ-M4VM...

fr.cnieg.keycloak:attribute-login-provider (1.3.7), org.keycloak:keycloak-crypto-fips1402 (22.0.2) +13 more potentially affected by CVE-2026-1190 via org.keycloak:keycloak-services (22.0.2)

org.keycloak:keycloak-services MAVEN version 22.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - fr.cnieg.keycloak:attribute-login-provider 1.3.7 - org.keycloak:keycloak-crypto-fips1402 22.0.2 -...

com.github.vzakharchenko:chillispot-radius-plugin (1.3.7), com.github.vzakharchenko:cisco-radius-plugin (1.3.7) +23 more potentially affected by CVE-2026-1190 via org.keycloak:keycloak-services (13.0.1)

org.keycloak:keycloak-services MAVEN version 13.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin 1.3.7 -...

io.github.johnjcool:keycloak-cas-services (>=4.1.0.final, <=4.1.1.final), org.keycloak:keycloak-dependencies-server-min (4.1.0.final) +3 more potentially affected by CVE-2026-1190 via org.keycloak:keycloak-services (4.1.0.final)

org.keycloak:keycloak-services MAVEN version 4.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - io.github.johnjcool:keycloak-cas-services =4.1.0.final, =4.1.1.final -...

org.keycloak:keycloak-authz-policy-drools (2.2.0.final), org.keycloak:keycloak-dependencies-server-all (2.2.0.final) +4 more potentially affected by CVE-2026-1190 via org.keycloak:keycloak-services (2.2.0.final)

org.keycloak:keycloak-services MAVEN version 2.2.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 2.2.0.final -...

fr.cnieg.keycloak:attribute-login-provider (1.4.1), org.keycloak:keycloak-crypto-fips1402 (23.0.5) +13 more potentially affected by CVE-2026-1190 via org.keycloak:keycloak-services (23.0.5)

org.keycloak:keycloak-services MAVEN version 23.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - fr.cnieg.keycloak:attribute-login-provider 1.4.1 - org.keycloak:keycloak-crypto-fips1402 23.0.5 -...

org.keycloak:keycloak-account-freemarker (1.7.0.cr1), org.keycloak:keycloak-broker-oidc (1.7.0.cr1) +9 more potentially affected by CVE-2026-1190 via org.keycloak:keycloak-services (1.7.0.cr1)

org.keycloak:keycloak-services MAVEN version 1.7.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.7.0.cr1 - org.keycloak:keycloak-broker-oidc 1.7.0.cr...

org.keycloak:keycloak-account-freemarker (1.2.0.beta1), org.keycloak:keycloak-broker-oidc (1.2.0.beta1) +4 more potentially affected by CVE-2026-1190 via org.keycloak:keycloak-services (1.2.0.beta1)

org.keycloak:keycloak-services MAVEN version 1.2.0.beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.2.0.beta1 - org.keycloak:keycloak-broker-oidc...

org.keycloak:keycloak-dependencies-server-min (4.0.0.beta2), org.keycloak:keycloak-model-jpa (4.0.0.beta2) +2 more potentially affected by CVE-2026-1190 via org.keycloak:keycloak-services (4.0.0.beta2)

org.keycloak:keycloak-services MAVEN version 4.0.0.beta2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-dependencies-server-min 4.0.0.beta2 - org.keycloak:keycloak-model-jpa...

fr.cnieg.keycloak:attribute-login-provider (1.3.4), io.phasetwo.keycloak:keycloak-orgs (>=0.24, <=0.27) +25 more potentially affected by CVE-2026-1190 via org.keycloak:keycloak-services (21.0.2)

org.keycloak:keycloak-services MAVEN version 21.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - fr.cnieg.keycloak:attribute-login-provider 1.3.4 - io.phasetwo.keycloak:keycloak-orgs =0.24, =2.5,...

org.keycloak:keycloak-authz-policy-drools (3.1.0.cr1), org.keycloak:keycloak-dependencies-server-all (3.1.0.cr1) +4 more potentially affected by CVE-2026-1190 via org.keycloak:keycloak-services (3.1.0.cr1)

org.keycloak:keycloak-services MAVEN version 3.1.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 3.1.0.cr1 -...

org.keycloak:keycloak-dependencies-server-all (10.0.0), org.keycloak:keycloak-dependencies-server-min (10.0.0) +5 more potentially affected by CVE-2026-1190 via org.keycloak:keycloak-services (10.0.0)

org.keycloak:keycloak-services MAVEN version 10.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-dependencies-server-all 10.0.0 - org.keycloak:keycloak-dependencies-server-m...

org.keycloak:keycloak-account-freemarker (1.0-beta-2), org.keycloak:keycloak-login-freemarker (1.0-beta-2) potentially affected by CVE-2026-1190 via org.keycloak:keycloak-services (1.0-beta-2)

org.keycloak:keycloak-services MAVEN version 1.0-beta-2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.0-beta-2 - org.keycloak:keycloak-login-freemarker...

org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (>=1.1.0-alpha.2, <=1.1.0-beta.1), org.keycloak:keycloak-account-freemarker (1.1.0.final) +2 more potentially affected by CVE-2026-1190 via org.keycloak:keycloak-services (1.1.0.final)

org.keycloak:keycloak-services MAVEN version 1.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.jboss.aerogear.unifiedpush:unifiedpush-auth-server =1.1.0-alpha.2, =1.1.0-beta.1 -...

org.keycloak:keycloak-authz-policy-drools (2.5.0.final), org.keycloak:keycloak-dependencies-server-all (2.5.0.final) +5 more potentially affected by CVE-2026-1190 via org.keycloak:keycloak-services (2.5.0.final)

org.keycloak:keycloak-services MAVEN version 2.5.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 2.5.0.final -...

org.keycloak:keycloak-dependencies-server-min (4.8.0.final), org.keycloak:keycloak-model-jpa (4.8.0.final) +2 more potentially affected by CVE-2026-1190 via org.keycloak:keycloak-services (4.8.0.final)

org.keycloak:keycloak-services MAVEN version 4.8.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-dependencies-server-min 4.8.0.final - org.keycloak:keycloak-model-jpa...